Simon vs. Hoff: Who is Baiting? Who is Switching? And why does this smell like SCADA?

Mainly because I need to get a non-political blog in the top position again (because I'm certainly no expert on virtualization security, but I am a virtualization end user who wants to know! ) but Simon Crosby's reaction to Hoff gives me a feeling of deja view in terms of the bait-and-switch approach to vulns I've heard from some SCADA vendors (or control systems standards efforts) over the years.

Although slightly more sophisticated than spouting off how many bits of encryption a protocol uses, saying that a given protocol is not Internet-facing, or claiming that to fix an implementation flaw in a weak protocol you should upgrade to protocol that uses SSL, some of the security cliches (or at worst, half truths) that undermine his credibility, and even I can recognize include:

• Open source is more secure...
• He mentions viruses and virus vendors in his first breath.
• Equating security fixes with security/insecurity (and slamming VMWare!)
• Bringing up EAL something or other
  
• Mentioning TPM in any context

Knowing a thing or two about mania, I'm also curious about this sort of manic efforts (apart from making it so small you can't even see it) to secure the hypervisor, and whether he is willing to admit that there are some classes of attacks against guests (or, obviously, against the hypervisor) that are unique (or perhaps only possible) in a virtualized environment and that they care about? Or will the AV vendors solve these, too?

Done. There no more faux Hillary (or Hilter) on top. Can sleep now.

Sore Loser, Racist, Unethical (All you need!)

And I could have just watched this instead of Tuesday night

Funniest YouTube in A While

Even better if you've seen Der Untergang but amazingly well done!

But obviously quite vulgar so don't watch if you are easily offended. (I warned you!)

Best Line: "The Voters have stolen my nomination"

Runner Up: "I'm so sick of drinking whisky with those pigs"

EVDO airframe drivers and Hardy

Turns out (big surprise!) I was full of it the other night for contemplating leaving Linux for OpenSolaris to get better USB throughput.

[ 63.558567] /build/buildd/linux-2.6.24/drivers/usb/serial/usb-serial.c: USB Serial support registered for airprime
[ 63.558587] airprime 2-1:1.0: airprime converter detected
[ 63.558675] usb 2-1: airprime converter now attached to ttyUSB0
[ 63.558719] usb 2-1: airprime converter now attached to ttyUSB1
[ 63.558761] usb 2-1: airprime converter now attached to ttyUSB2
[ 63.558768] airprime 2-1:1.1: airprime converter detected
[ 63.558812] usb 2-1: airprime converter now attached to ttyUSB3
[ 63.558854] usb 2-1: airprime converter now attached to ttyUSB4
[ 63.558897] usb 2-1: airprime converter now attached to ttyUSB5
[ 63.558903] airprime 2-1:1.2: airprime converter detected
[ 63.558946] usb 2-1: airprime converter now attached to ttyUSB6
[ 63.558995] usb 2-1: airprime converter now attached to ttyUSB7
[ 63.559037] usb 2-1: airprime converter now attached to ttyUSB8
[ 63.559043] airprime 2-1:1.3: airprime converter detected
[ 63.559088] usb 2-1: airprime converter now attached to ttyUSB9
[ 63.559129] usb 2-1: airprime converter now attached to ttyUSB10
[ 63.559171] usb 2-1: airprime converter now attached to ttyUSB11
[ 63.559180] usbcore: registered new interface driver airprime
[ 63.577915] /build/buildd/linux-2.6.24/drivers/usb/serial/usb-serial.c: USB Serial support registered for GSM modem (1-port)
[ 63.577937] usbcore: registered new interface driver option
[ 63.577939] /build/buildd/linux-2.6.24/drivers/usb/serial/option.c: USB Driver for GSM modems: v0.7.1

And

mfranz@ubuntu-t61:~$ lsmod | grep usb
usbserial 35688 5 option,airprime
usb_storage 73408 0
libusual 18980 1 usb_storage
scsi_mod 151180 6 usb_storage,sbp2,sr_mod,sg,sd_mod,libata
usbcore 146028 8 option,airprime,usbserial,usb_storage,libusual,ehci_hcd,uhci_hcd

Port Forwarding on Windows (Python to the rescue)

If there are Windows equivalents of redir I'm not aware of them, but the first proxy I tried on A list of open-source HTTP proxies written in python (a cool site I ran into several years ago) was TCPWatch and it worked great (at least on Python 2.5.1 under cygwin.)

(Truth be told, the first tool I ran across was pinhole in an ASPN recipe but it ran into some issues, possbly thread related)

He's closed it

Finishing up the dishes (2 and half kids in bed) and listening to Obama's victory speech and it feels like a winner. The high road. Classy. Presidential. Finally an uplifting Tuesday.

"We will end it by telling the truth..."

Nice.

A Quarter from Report to Disclosure: Respectable

From the CORE Advisory on Wonderware

WTF is Python?

* 2008-03-03: Core sends proof-of-concept code written in Python.
* 2008-03-05: Vendor asks for compiler tools required to use the PoC code.
* 2008-03-05: Core sends a link to http://www.python.org where a Python interpreter can be downloaded.

and

of the advisory is re-scheduled to March 31st 2008. With regards to the questions and requests about the contents of the security advisory, Core indicates that Core's technical publications are aimed at providing legitimate security practitioners worldwide with the technical details necessary to understand the nature of the security issues reported; so they are able to devise, by their own judgment, the risk mitigation approach that fits them the best. For that purpose, Core believes that it is fundamental that they have precise and accurate technical details about security issues -- as Wonderware itself has demonstrated with the request for further technical details and proof-of-concept code -- and that the whole reporting and disclosure process is transparent for scrutiny of all interested parties.

And back at ya..

The vendor says that is having trouble understanding what the value is in providing specific detail as to what technical issue is happening and asks for clarification to understand how this information would benefit organizations. The vendor acknowledges that the proof of concept code did help to replicate the issue and that without it, it would have needed more time to identify it from the report alone. The concern is that the details provided in the report may give a hacker a specific direction to look for the vulnerability. Finally, the vendor indicates that will have a better estimation for the rlease date of a fix by Friday March 28th, 2008.

A level playing field?

Thus, Core believes that it is necessary not only to indicate the mere existence of the bug, but also to explain how to uniquely identify it in the vulnerable software (to avoid confusion with all other known bugs or to differentiate it from others that may be discovered in the future). It is also important to determine how the vulnerability could be used by potential attackers so that proper detection mechanisms can be built, for example firewall rules, or IDS and antivirus signatures. While Core recognizes that this may provide some additional data to would-be attackers, clearly it also provides preciously needed information to the defenders thus, leveling a field on which Core believes the attackers are initially at advantage.

And all for just a DOS?

Welcome to the party!

A Spade?

Interesting Nation article that unpacks this notion of "electability"

So, in the name of another personal quality--honesty--I'd like Hillary Clinton to make the following statement: "Though my opponent has run a terrific campaign, in primary after primary, I have proven that I am the more electable candidate. I am more electable because I am white. Barack Obama--Wow!--he's certainly inspired a lot of hope, but as voters in Indiana and North Carolina make up their minds, as the superdelegates make up their minds, they should remember that Barack Obama is black. They should also remember that a whole lot of white working-class Americans are racists. White racists are an important part of the Democratic Party, and time and time again, they've supported me because I am white. I am ready on day one to govern as your white American president."

Faster EVDO: Maybe A Reason to Try OpenSolaris?

So the Linux USB serial driver is capped at 500Kb and as I found tonight (piece of shit RCN is averaging about 50% uptime these days) it was pretty much impossible to watch 30 Rock (or any of the other streaming NBC shows) with my EVDO card plugged into my Linux router. (or now that I think of it, maybe this is a just QoS issue since I'm going from 100Mb to 500kb?) but of course when I plopped the card into XP got 1MB easy and we could watch all about the Teamster sandwiches with no problems.

But this OpenSolaris WWAN project looks promising.... Wonder if I can get my Novatel card working with Nexenta Core?

Or are there any of the EVDO routers (that take USB) that don't run Linux or have somehow managed to work around the 500Kb cap?

To answer my own question, it looks like the airpime drivers might actually do the trick.

The Cheap Thrill of Using Enterprise Security Tools to Monitor Your Kid's Surfing Habits

One of the nice things about working for a security vendor is being able to able to run cool product on your home network (like when I brought a Cisco 7120 home!). And given the complexity of my home network (4-5 routing/forwarding devices, 2-3 switches, and 10-20 hosts up at any given time) it's not as much overkill as you might think.

The image below shows a 5-day view of my network events using LCE.

The 2nd row is the "firewall" category which primarily consists of syslog's from my two Cisco 851's. The events drop off 2-3 days ago when I disabled the ACLs and forgot to turn them back on.

Oops.



The last row is "web" which you'll see a spike during the last day.

What happened is I finally qot squid up an running for my son so he could use the Linux box in his room. Yeah normally a bad idea but probably not relevant if have security tools that cost as a midsize car watching your network.

If I drill down on the "web" events and find that they are all from squid logs (access.log) which I'm monitoring with an LCE client.



Most of the denies were to sb.google.com so I went into the whitelist and added that so that should flatten that plot.

Drilling down on the cache hits, I can see many of the thumbnails for one of the game sites I let him go to are being cached:

1209917543.808 7 192.168.2.170 TCP_HIT/200 19581 GET http://media.y8.com/gfx/y8bartender1.jpg - NONE/- image/jpeg
1209917543.870 52 192.168.2.170 TCP_HIT/200 12089 GET http://media.y8.com/gfx/thumb_399.jpg - NONE/- image/jpeg
1209917543.871 4 192.168.2.170 TCP_HIT/200 15471 GET http://media.y8.com/gfx/y8family_restaurant.jpg - NONE/- image/jpeg

And a one of the misses shows the sort of games my 9-year old likes to play.

1209906995.596 154086 192.168.2.170 TCP_MISS/503 1420 GET http://y8.com/tags/Killing - DIRECT/y8.com text/html

No More Suit/Tie in Indiana

A while back, my wife and I were talking about what it is that sounds fundamentally different about the way Obama, Bill Clinton (and Reagan, for that matter) speak and the last few Democratic candidates such as Gore, Kerry, and Hillary.

Whether they actually are or not, the latter sound like they are talking down to you, like they are patronizing you, lecturing you. And when try to talk "at your level" they sound inauthentic, scripted, stilted. I think is one of the factors why Kerry (and Gore, if you believe he actually lost) were beaten by a W.

Hillary knows this and this and she wants to paint Obama like Dukakis and Kerry were painted. This is why Clinton (channeling Rove, attacking strengths not weaknesses) attacked Obama as an elitist. I don't know much about community organizing, but I know that most people that have had non-elite jobs, those that have not had the upper advantages on their side from day one. I'm talking about public school teachers, the police, like those serving in the military (even as an officers) that have force you to be exposed (and work alongside, even when in a position of authority) folks from all walks of life -- do not talk this this.

Then of course there is a regional/dialectal element as well Gore is Southern but the patrician, old money South. Kerry, Dukakis, and Hillary are "Yankees" (as my wife would say) and just they can they can lose this from their identity that no more than Stringer Bell or D'Angelo Barksdale could lose the street.

Your Little Friend Alsamixer

So I totally managed to screw up my kernel-modules (hint: trying to uninstall a running kernel package is never a good idea) so I ended up doing a new install of Hardy late last night. I only had server image so I used that. But no sound? So I ended up following the quite excellent SoundTroubleshooting wiki page and ran across the alsamixer command. I may have used it before. Not sure, but it helped me track down that the speaker was on mute. I'm still running into some weird GNOME (or GDM) startup issues when using XFCE or standing GNOME bootup.

A Little Post-Ikea Saturday Humor

East-west trips from Skokie to Schaumburg can be brutal. And then with three kids in the big yellow and blue (although we have discovered Smaland, thank God) but today wasn't too bad.

But watch this before they pull it down (or Youtube's CDN goes down). The last few weeks have been pretty depressing politics wise, but this is good fun.

Prez & Pedagogy on The Wire

I wouldn't know about policing or politics (although all the SIGINT doesn't seemed too far-fetched) but in Season 4, much of the school story line is spot on. Or at least based on my 3 years teaching in a Middle School.

Of course I wasn't in a failing inner city Middle School like Mr. P (coincidentally, so many of my kid's teachers here on the Chicago North Shore have have even more unpronounceable Polish names, but I digress...) but a lot of it still rings true.

After college (think Netscape IPO time), I taught 7th and 8th in a school that implemented many of Ted Sizer's ideas on school reform on the Northwest side of San Antonio, where kids lived in the same gated community as David Robinson and George Strait.

Although I had my share of "challenging" kids not I can't remember being told to Fuck Off like Mr. P and the only blood I ever saw in the class room was from bloody noses.

And although I left teaching (for tech) over ten years ago, so many of the scenes in the latest (meaning what we are watching now) season take me (and my wife, who was also a teacher) back to our frightening "first year" and give me a sick feeling in my stomach.

Stuff like getting your classroom ready. Never being prepared enough. That awful silence in the morning that will soon be broken when the door opens. The perceived weakness and lack of confidence that let's your classes get out of control (relatively speaking, of course). The older female teachers that get the respect you wish you could command -- and the fear, which you hope you never will. The making it up as you go along, figuring out a month in what you should have done the first day (like come up with a classroom management plan). And then there's the good stuff, too. Creating that fragile bond with your students. And the humor and the tragedy. We've just finished Disc 2 so it will be interesting to see where this ends up.

Nice Corrective on Clinton Foreign Policy

If you want to stroll memory lane, check out this Nation piece on Clinton foreign policy.

The whole thing is worth reading, but here are some of the highlights I remember from the 90s. In particular I remember Somalia (while I was in college) then resulting genocide in Rwanda. Remember how they showed all the bodies floating down the river?

Yeah, happy times. Bring back the 90s.

The Clinton record on which Hillary is running is anything but stellar in global or even US security terms. What would become the hallmark political timidity of the Administration was first demonstrated after eighteen American troops were killed in Mogadishu in October 1993 in an ill-fated assault on a Somali warlord. Though that operation was entirely American-planned and led, the Clintons let stand (if not promoted) the isolationist falsehood that the tragedy was the fault of the United Nations, which also had a peacekeeping mission in Mogadishu.

and

The Clintonian record on Osama bin Laden, Afghanistan and the defense of the United States itself is both bleak and tragic in the light of what happened after the Clintons had gone from the White House. The trial of Ramzi Yousef, implicated in the first attack on the World Trade Center in 1993, had revealed an Al Qaeda blueprint for strikes against high-value American targets, but the Administration did not act expeditiously to shore up policies and tools at home for dealing with this possibility--or inevitability.

Instead, the Clinton Administration focused on Khartoum, where bin Laden had established a base. He was ultimately chased out of Sudan under US pressure, only to find in a welcome haven in battered, bankrupt Afghanistan, first under the mujahedeen and then the Taliban. One useless US missile attack on an Al Qaeda camp there in 1998 after the bombings of two American embassies in Africa failed to do him any harm. (The United States also hit a pharmaceutical factory in Khartoum, possibly the wrong target, in an effort to destroy what was believed to be a chemical weapons facility.)

and to concluded

Administratively, the Clintons (we are now asked to assume that it was both of them) signed off on a reform that took away the independence of the Arms Control and Disarmament Agency, merging it, as well as the United State Information Agency, into the State Department. Arms control lost an important voice in policymaking. Crucial information services took a hit worldwide, and the United States could not have abandoned an effective public relations tool at a worse time.

In diplomacy, even a veneer of decency and statesmanship can matter. Neither Richard Holbrooke, the author of Dayton, who lost no opportunity to refer to the UN as "deeply flawed" or Secretary of State Warren Christopher, who disposed of Boutros Boutros-Ghali in the most high-handed and thoughtless manner, can lay claim to glory as statesmen. Albright, responding to critics at the UN, reminded everyone that we are the "indispensable nation," so get over it.

Could there be a subliminal message now in talking tough to foreigners? Is Barack Obama somehow one of them? Patriotic lapel pins are in and substantive discussions about America and the world are not.

I wish more would have spent on exploring the possibilities of continuities (or at least Bush foreign policy as a logical consequence/progression) of the Clinton years, but perhaps that can be found elsewhere.

Open Source Virtualization in Ubuntu Hardy (First Impressions)

So Open Source Virtualiztion in Ubuntu hasn't been a smooth ride. The linux-virtual and linux-xen kernels panic my T-61 due to what appear to be SATA and USB issues, respectively, but KVM seems to be working a little better (you need to apt virt-manager, kvm, libvirt-bin, and probably a few others) and actually surprisingly snappy.

Virtual Manager is now included and works reasonably well (if run as root, there are some permission issues) to provide VMWare-console like experience. I was able to boot (from the .iso) a Debian Etch install but I aborted due to hda (DSC Timeouts) but Hardy Server worked amazing well:

root@ubuntu:~# uname -a
Linux ubuntu 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686 GNU/Linux
root@ubuntu:~# cat /proc/cpuinfo
processor : 0
vendor_id : GenuineIntel
cpu family : 6
model : 2
model name : QEMU Virtual CPU version 0.9.1
stepping : 3
cpu MHz : 1994.872
cache size : 2048 KB
fdiv_bug : no
hlt_bug : no
f00f_bug : no
coma_bug : no
fpu : yes
fpu_exception : yes
cpuid level : 2
wp : yes
flags : fpu de pse tsc msr pae mce cx8 apic mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 up pni
bogomips : 4007.02
clflush size : 64

Networking "just worked" a pleasant suprise thinking about what a pain it used to be back in the day with User Mode Linux. You'll also note that you connect into the console via VNC, which was nice.

Update
So Hardy seems to be the anomaly. OpenBSD 4.2 failed to install, Ubuntu 7.10 failed to boot the CD. Also Virtual Manager frequently wouldn't start up or shutdown VM's.

So all in all a pretty dismal picture.

Stumped Nails It

In Hillary Clinton, GOP Heroine Andres Martinez, nails it:

Clinton is a capable woman who'd make a credible presidential candidate in her own right. But she is not here in her own right. She is cashing in on her husband's brand. She didn't become a senator just because she is hard-working and smart and talented. She also became a senator (in an adopted home state, no less) because she was the president's wife -- and not just the president's wife but the president's aggrieved wife, able to draw on a reservoir of good will and sympathy. How her ascent advances the meritocratic cause of women is beyond me.

We all know this, and yet the Clintons ask us to deny it. They also ask that we accept the notion that a term and a third in the U.S. Senate is plenty of experience, while two-thirds of a term is woefully lacking. There have been plenty of other conceits we have been asked to accept along the way, including that one about how you could innocently "remember" coming under sniper fire when you never had.

This was Hillary Clinton's nomination to lose. And if she had won it as expected, none of this would be worth revisiting -- the voters would have spoken, and the nomination would be rightfully hers. But she failed to win it. Obama won't win either, at least not on the basis of pledged delegates, but he is ahead both in the delegate and popular count, and has wildly surpassed expectations.

A Worthy Replacement for My 12" Powerbook G4?

The HP2133 looks amazing. Probably no coincidence that it looks like my old PowerBook. About one more year on AppleCare left on it.

My New Minimalist Retro Desktop

So despite my glowing reports about hardy it hasn't been all wine and roses. I finally filed a a really annoying bug which causing the keyboard to go wacky in X, so that I couldn't enter any control characters. That is the bad news. Really annoying. At first I thought it was just some weird control character shit within gnome-terminal that was screwing up remote minicom sessions (IOS wasn't too happy either) but no it was the whole shebang.

But in the good news, having HAD IT with Openbox (it too was not happy under Hardy, and WTF can't I disable window contents when moving them!) I've fallen in love with fluxbox and (as you can see) it plays nice with panel apps like nm-applet, pidgin, and amarok. And good old gkrellm does a really nice job on Thinkpad hardware stats.

And oh yeah, gRun is so much faster than using blasted GNOME/KDE menus.

Believe me.

So who needs OSX?

(Well actually I still haven't had much luck with dual headed displays, so maybe I still do)

Cisco Convergence Award: Garretcom

Similar to the Daily Dish Awards this probably gets the Cisco Convergence Award - which means everything is better over Ethernet/TCP/IP!.

Way to go GarretCom!

Establishing common ground between physical and cyber security strategies

As industrial networking evolves and processes change at a rapid pace, the need for cost-effective security is at an all time high. Today, a dependable industrial network operation is not just nice-to-have, but a must, as is the need to understand the interrelated structure between physical and cyber security.

IP technology offers many benefits including network flexibility, increased productivity and cost-savings. Moreover, bandwidth in Ethernet-based protocols is rapidly increasing, enabling fiber and copper media to transmit more data.

Tune into this Control Engineering editorial Podcast and listen to success stories from combining physical security and IP functionality, including cyber security, on existing IP-based systems.

* Combining fire, security, and access control into a standard IP-system to increase security and simplify management by bringing the control in-house.
* Having access logs, intrusion detection and fire alarm reporting to one control station.
* Using hardened Ethernet switches and PoE (Power over Ethernet) to make it possible to deploy IP-based security devices reliability and cost-effectively throughout a hostile and/or widely distributed industrial environment.

95%

Although I started a blog how my wife is like Tom Hayden's wife (yes that Tom Hayden) but the exit polls were more interesting.

VMWare Server on Ubuntu Hardy

This is all you need, but the libgcc was what tripped me up:

# unzip VMware-server-linux-client-1.0.5-80187.zip
# tar xzf VMware-server-console-1.0.5-80187.tar.gz -C /tmp
# cd /tmp/vmware-server-console-distrib
# sudo ./vmware-install.pl
# sudo cp /lib/libgcc_s.so.1 /usr/lib/vmware-server-console/lib/libgcc_s.so.1/

I've been hacked by PBS Kids!

So this is as a pretty good example of why you need to tune your Snort signatures. These are what have fired from the Debian signatures. Pretty lame, huh?

As my 4-year old would say (DUH!)

From Call is out to bring security testing into the QA process

Testing the security of software applications should be part of the process of developing the software, not an afterthought. But one security analyst says that’s easier said than done.

Danny Allan, an IBM security researcher, made the case for advancing security research for software applications at the Software Test & Performance Conference April 16.

Allan argued, citing Gartner research, that while 75% of IT attacks are targeted at applications, 90% of IT security spending goes to securing the network, not the applications.

Oh and you can get rid of all those pesky firewalls, too.

OpenBSD Finally Gets WPA/WPA2

This could be good news for all those fools^H^H^H^Hfolks that try to run *BSD on their desktop/laptops (although I'm sure someone will prove me wrong, cause I didn't take the time to man those devices)

Damien Bergamini (damien@) just committed WPA-support (wikipedia) for OpenBSD. In the commit message, Damien states that "bwi(4), malo(4), ral(4), iwn(4), wpi(4), ural(4), rum(4), upgt(4), and zyd(4) should work." And, Damien says "support for more chipsets should arrive soon."

To me this is of more significance for folks that build wireless routers than anything else.

But what do I know/care. Although truth be told I wouldn't mind running PF as my home firewall if the USB EVDO card would work.

Another Small Cheap Linux Laptop (like the Eee PC) Except This is Completely Resistent to Worms and Viruses

Ran across the InkMedia on LinuxDevices that is in the same class as the Eee PC with the following specs:

VIA C7-M ULV Processor
Internal 8.6" Diagonal SVGA (800x600) LCD panel
Supporting 1024 X 768 True Color Video Output on external monitor
Supports MPEG2 and MPEG4 decode acceleration in hardware.
4 USB 2.0 ports, 1 USB 1.1 port (for keyboard)
2 SD slots
512 MB Ram
2 GB NAND Flash, containing read only file system (compressed)
User file storage on SD card
1 Stereo minipin audio out, stereo minipin mic in
1 RGB out for VGA monitor
10/100 Ethernet jack
802.11 a/b/g WiFi
100-250V 50/60Hz universal power supply
5-8 Hours of battery life

The most impressive thing is it is completely secure

After many years of working with School Net India, Gerry Morgan, the founder and designer behind InkMedia, became frustrated with the huge number of computers that were ruined because of virus infections. As a result, he set out to create a computer with a flash-based operating system that comes with software imbedded into its core. It has everything that a typical student, family or small business would need.

It figures the Canadians would come up with a completely secure device first. Damn them. One step behind. And their restrooms are cleaner, too (at least the ones I remember on Vancouver Island)

Obama Rally in Philly Last Night

Not a small crowd. Not a bad speech. Do I believe every line? No. Can the tide of Globalism be stopped? No. Are those rustbelt jobs coming back? No. Do I really think McCain is a Bush third term? No.

If elected, how much could Obama really accomplish? Could he break gridlock and change "the game?" Who knows?

That is not the point. We don't know those answers, but we do know that things need to be shaken, not stirred and the chances of that occuring with Clinton (or McCain) are slim to none. Then of course there is the painful prospect of listening to a Clinton (with her disgusting Chicago accent and patronizing Gore/Kerry-like tone) inaugural address or State of the Union or even press conference is too unbearable to contemplate.

It wasn't my fault, Dad!

It was that computer you were on!

Blame it on Jing!

Well I did a little bit worse than last last year on getting the old taxes in (hour and a half to spare), but hey a lot going on (like selling my house!) but the real culprit was Jing. Or the fact that the addition of Sam has cleaned one to many brain cells causing me to forget my Intuit password like every hour.

Another I-35 Security Startup

Following my LinkedIn updates led me to CoreTrace and this great picture.

I don't wnat this guy anywhere near my endpoint. Wonder how long he'll will be the mascot? He looks like he could get a bit bitter and cling to guns (but probably not religion!) if his VC money drys up and he had to go work on 6th Street.

Then he could do shots with Hillary and drive over to College Station and go shooting near the Brazos River like I used to do back in the day. Meaning the shooting part. Nothing like a nice stream bank to unload a few clips.

But application whitelisting? And from the usual suspects (if you were anywhere close the Austin/San Antonio scene in the last decade) but speaking of Austin startups that green appliance sure looks nifty. And based on the screencast, looks a hell of a lot easier than SmartBits/WebAvalanche. What a pain!

As Clean As It Gets

House goes on the market soon. Third house we've had to make ready in four years. No more moves after this one.

But this is the hole where I'll be working until June or when the house sells, whichever comes first.

And for those of y'all in more temperate climates, it is still cold enough to wear a stocking cap, especially in my basement office.

I don't give a shit, I'm a researcher (and the E-Word in SCADA)

I wasn't at RSA but based on this An Open Letter to Joanna Rutkowska this session would have been either really cool (or really frustrating to see)

I think it's only fair to point out that given your performance, you're not only an "independent researcher" but more so an "independent contractor." Using the "I'm a researcher" excuse doesn't cut it.

I know it's subtle and lots of folks are funded by third parties, but they also do a much better job of drawing the line than you do.

Despite your position on the matter and unlike you, I do give a shit, Joanna. I care very much that your research as presented to the press and at conferences like RSA isn't only built to be understood by highly skilled technicians or researchers because the continued thrashing that they generate without recourse is doing more harm than good, quite frankly.

Now, I know you can't control the press or what they print, but you certainly don't seem to invest much in terms of ensuring accuracy or clarifying the corner cases you're talking about. Here's an example from a Forbes article based upon your RSA presentation:

This is actually not entirely irrelevant to another classic discussion on Ethics on the SCADA mailing list but I have to get back to getting my house ready for the photo shoot tomorrow!

For some reason this comment me of a line from the Hunt for Red October, when a much thinner Alec Baldwin, says at a critical moment in the movie, "I'm just an analyst." And the San Angelo movie theatre (full of 98C's and 98G's from Goodfellow AFB) breaks out laughing. Much simpler times.

Ah to be 19 again. Just kidding!

What the hell are Midwestern Values?

I was born in Kansas (but never lived there much) but I'm at a loss for these "Midwestern Values" Hillary refers to in her attacks on Obama? Of course this infers that Obama does not have them.

Some here are some some ideas my wife and I came up with

* Insanely clean floors (or perfectly rounded shrubs)
* Taking your Christmas lights down within two weeks (or not leaving you Christmas tree in the back yard until the first day of Spring, like someone I know)
* At least 6 months of Cheerios in your pantry (or "storm cellar")
* Informing on your neighbors? (or at calling the village when your dog barks too much)
* Fascist snow day regulations (you know, the even/odd thing that cost me hundreds of dollars since I moved to Skokie)

Then of course it gets interesting if you replace Midwest with Mideast, West Coast, Southern, African, Indonesian, Hawaiian, Asian, etc.

But the good news, after Hillary's response to Bitter-gate, my wife finally thinks Hillary is evil!

Yes, I have won!

NOTE: If you are wondering about the image, that (and all sorts of other freakish things) came up when I did a google image search for "midwestern values"). If female robots are the embodiment of "midwestern values" you can count me out.

CNN Gets it Right on the Bitterness (or Blue Collar Park Ridge?)

Hardy Heron Beta and T-61: Pretty Much the Perfect Laptop

With all my whiny blogs lately I figured I'd do something positive for a change. A few weeks ago I took the plunge with the Hardy Heron (the next LTS) release and it definitely had a few rough spots, but at least on my T-61 it is definitely the best distro I've tried so far and things have been pretty stable, especially give the hundreds of package updates to core components since then. Performance is improve. Suspend and hibernate work perfectly now without any special hacking. This is was not the case with Gutsy. Wireless/Network Manager seems much more reliable. And then there are few security features. Ubuntu finally has a firewall (/etc/init.d/ufw) which isn't enabled yet in my build. GPG is integrated into the desktop. You can right-click to encrypt/sign files. Java installed perfectly when I went to Hushmail. Flash did, too. And the fonts, there seems to be big improvements there as well.

See the wiki page for the complete list of stuff and keep the Ubuntu spirit alive!

But what's up with "wintry mix" of rain and snow around tax time?!?

The Angry Bitter Rustbelt

So even Andrew Sullivan (about as big as an Obama fanboy as you can find) is somewhat critical of the Obama remarks about the "bitterness" working class whites. But I don't find much to disagree with in the spirt or the words themselves.

Three weeks ago we drove from Chicago to Frederick, Maryland and back. On the way East we took the Southern route down through Indianapolis (the Northern suburbs, where we stopped for dinner, seems surprisingly nicer, nicer than the Indianapolis I remember from 1980) and spent the night in Columbus, which wasn't too bad either. We drove through the old factory towns of Eastern Ohio. Down into Maryland through Cumberland, Hagerstown, then Frederick.

On the way back I accidently took the PA Turnpike (and was pleased to see my iPass worked) and it had a much different feel. Particularly around Pittsburgh, then heading North through Youngstown, then Akron, before spending the night in Cleveland. The decay was visceral. The rot. The feeling of places that have been but that no longer are. (I wish I could find a comparison between Texas and Ohio that I found somewhere, that came out during the primaries that illustrated the opposite path these two states were on, on a number of levels.)

A couple of years ago when we decided to move from Austin, were briefly considered Pittsburgh (I was entertaining the idea of trying to get a job CERT) but all the research my wife did, it seemed to be one of the most racist intolerant places in the country driven by pent up anger and bitterness (damn foreigners taking our American jobs away, since all the best jobs belong to Americans you know! We deserve factory jobs were folks make as much as MCSE's) Sure there was a haven around Universities and you could get some cool houses for relatively cheap in Squirrel Hill, but who would want to live there? Especially with an adopted Chinese daughter? Even the Episcopal Church is stuck in a time warp there.

Call me an elitist (or just nostalgic about the Great State of Texas) but these "blue collar" parts of Ohio or Pennsylvania seem scary in ways that parts of East Texas (or West Texas) are certainly not. Yes there is Jasper, but there is something different about the racism in a place that actually has minorities than what that doesn't. There is something different about states that are on a downward trajectory and those that have some life in them (the Sunbelt) with people on the move, with a horizon in front of them, people moving in, moving out, people that are not stuck between hills, along the rivers, in dying little downs with smokestacks

I think even think Illinois and the well-off North side of Chicagoland has a bit of that feel of death and rot that is hard to put a finger on unless you've lived somewhere else.

Layer 8 Stealth Firewall Switches

So here's a rule of thumb, if your knowledge of networking is based on what you can pick up at Buy Buy on that first trial credit card's they give you in college, you probably shouldn't be shooting your mouth off.

Read this fw-wiz thread to see what I'm talking about.

Happy Birthday Nessus!

Renaud has a nice Birthday writeup on Nessus over on the Tenable Blog.

I first used Nessus (and Ethereal, back when both were far less stable than they are now!) in the Summer/Fall of 1998 when I included it in "Network Attack & Defend," a five-day hands-on TCP/IP Security class I developed/taught down in San Antonio for Trident Data Systems. Lot of frequent flyer miles later, brain cells lost, grey hairs, since then....

(CAVEAT: I work for Tenable now)

Not Alerting on Scheduled Nessus Scans with Snort (Debian-style)

So my (Debian based) firewall routes traffic for the three subnets I have behind it, each which is front-ended by either a Cisco 851 or a Linksys AP. On one of the subnets I have a VM running Tenable Security Center which runs daily Nessus scans from two Nessus scanners.

The first scanner (on my Son's Ubuntu 7.10 Optiplex) scans the non-Linksys devices connected to the AP, both wired and wireless. (I exclude the traffic because even traffic through the APs hangs the WRT54G and sometimes the WET54G (bridge). The second scans its local subnet and the other Cisco-protected subnet. I will add a third Nessus scanner behind this subnet that scans back so that on the non-Linksys segments I have a perspective of scans both inside and outside the Firewall (meaning router ACLs)

But this obviously causes even the default Debian Snort ruleset to alert. So tweaking this knowledge base entry to the pecularities of a Debian (4.0) Snort install, I did the following:

1) Create an /etc/snort/excludes.conf that has BPF (not host scanner-ip) to ignore scans to/from that host

2) Modify the PARAMETERS variable in /etc/defaults/snort

# Parameters for the daemon
# Add any additional parameteres here.
PARAMS="-F /etc/snort/excludes.conf -m 027 -D -d "

3) Restart snort as usual
Simple, almost too simple to even blog about...

Luv Them Firewalls

I guess I'm one of those unsophisticated old fogies that block my kids access. Squid is down and 9-year old doesn't care that much and hasn't figured out he can just disable the proxy, but my 4 year old daughter's Internet addiction is is in full bloom on Mom's MacBook playing the Dora/Diego games and a year ago she ordered 2-3 seasons from iTunes before I figured out how to disable it.

The media, which all operate under direct or indirect state control, warn frequently about internet addiction when discussing technology's effects on youth. At the end of 2006, the media reported that the Central Committee of the Communist Youth League stated that more than 2 million children and teens were internet addicts. In 2008, the Xinhua news agency reported that 11% of youth ages 18 to 23 are addicted to the internet.

For God's sake for as long as she can remember she's see a laptop attached to her parents, so why shouldn't she be addicted too?

2nd Thoughts on Dell Laptops (based on Precision M65)

So I'm sort of a laptop snob. I don't care much for MacBook Pro's, let along their flimsier sibling. And Dell's well, I don't want to go there. But most of this experience is based on Latitude's and based on the Precision M65 I was issued this week, maybe I was overgeneralizing. First of all the [Nvidia] graphics are amazingly snappy and the display very crisp, but most importantly these guys are sturdy -- maybe even sturdier than my T-61. Plus, good port layout and even a real Serial port.

I didn't calculate the price difference (but I recently did between comparably equipped T-61's and a high end D-series Latitude, which was around 20% more than the Lenovo) but I'm guessing Thinkpad's provide better value.

BTW, although this box will remain XP only, I did boot up the Ubuntu Hardy Heron Beta and it worked great. Correct (1280x800) screen resolution and WPA worked like a champ on the Intel 3945 card.

So that is what "aspies" are?

I hadn't read Dailydave for a while but a reference to this craiglist entry has convinced me that I should read it more often...

I'm basically extremely lazy and I scope projects that take 4 hours of real work time for about 1-2 weeks since thats how long it takes to bring myself to work on whatever stupid project I'm assigned. I've been mudding against recently, I have to get the good eq. drops.

I work marginally well on teams. I dont have a problem with authority, I just dont view them as being authoritative. I am late to work constantly, but not _THAT_ late. I need at least $105k a year. I consistently order the most expensive drinks I possibly can get away with when the company card is down. I will even order drinks to then just pour out into the toilet or onto the carpet just to make the company tab higher.

I can program a variety of languages including but not limited to C, C++, a number of assembly languages, PERL, BASH, TCL and SPIN.

I cannot currently program ERLANG, SCHEME, PYTHON or RUBY but if required (which is highly likely if you think your company is a cool, hip and intelligent one), I can learn any of these languages in 2 days with fluent programmign ability with 2 weeks, as any real programmer can do with any language.

I'm an excellent programmer but many aspies (people with aspergers) can out-program me.

[snip boring stuff]

I have 10+ years in professional (PAID) computer security experience but the security industry is completely retarded now. So I don't want to secure your web apps, _AT ALL_.

Big Time Firefox3b4 and Google Apps Performance Increases

Up until now maybe spent an hour or so running Firefox 3, but since Ubuntu Hardy Heron (Beta) ships with Firefox 3 as its default, I've noticed huge improvements using Gmail and Google Reader, most likely due to the Javascript improvements.

Update
Vi movement keys don't work in Gmail though! Sort of annoying.

Hardy Heron Beta on T-61: First Impressions

So I just tried the LiveCD version of the beta and am pretty impressed. Since I need to start fresh in a few days (start with Tenable next week) and I've been getting some annoying reiserfs R/O inode errors, will probably do the deed real soon now. As is the case with any Ubuntu pre-release several 100 package updates in the works.

Two of three boots worked just fine (the one that failed I was messing with volume controls while GNOME was booting, coicidence?). Among the differences I noticed: Firefox 3.0b4, a new Encryption, Desktop Effects worked perfectly, didn't try WPA. Sound (and volume controls, that are more OSX like) worked perfectly. Codec finder worked on the second time and was able to fire up Radio Paradise and listen to a stream.

Update
Actual install and reboot went fine but after upgrading the packages, I ran into the same GNOME startup issue (hang). Basically you lose control over the keyboard (Caps Lock doesn't blink) but mouse is still active... weird. But rebooted and then went into the console and installed OpenBox, restarted gdm. This worked (non-GNOME) and then weirdly worked with Gnome, so perhaps this is a Nautilus/Metacity issue...

Funny and On Target But Still Depressed, Nonetheless

So I'm not ashamed to admit to voting for Dubya in 2004, mostly out of disgust for the Michael Moore and Moveon.org crowd, so based on this a strange logic, could I actually somehow vote for Hilary out of disgust for Hannity and Limbaugh?

It's conceivable.

First Strike: An Oldie But a Goodie

I know I saw this either in Basic Training or more likely in "Common Block" at Goodfellow AFB as motivation cross our zeros or slash our sevens or something..

My favorite line (From the young-ass 1LT in a missle silo), "so you gonna go out with me tonight... thought we'd check out the hacienda... maybe even let you treat?" Damn Zoomies always had it easy. Put their hands in their pockets. Of course Nerve agent or "Yellow Rain" (having grown up on Edgewood Arsenal and driven by all those barbed-wire encircled buildings with the funny smoke stacks) and the thought of wearing MOPP4 is a hell of a lot more frightening than instant incineration.

But the good thing about "the enemy" back in the day (if you buy this whole story) is everybody (or at least a few million) is a goner. Now it's like somebody pops a dirty bomb off in Alexandria or a suicide bomber visits the Las Vegas strip, you'll probably be fine, except your CSCO shares go back in the single digits or your 401k is toast.

I think I prefer MAD.

I wonder if kids these days even find this stuff compelling like I used to. Hell it scares me still. Certainly more than any 3 AM call.

My Gmail account is Experiencing Errros

Over the last month Gmail seems to have gotten slower (and slower and slower) and it is not just my Powerbook G4 and Firefox.

Having had to maintain Internet-facing devices under high loads (although certainly not at the level of Google Apps) things probably suck right now for Google Engineering. Pagers going off. Firing up the conference calls. Troubleshooting routers, switches, firewalls, load balances, web caches, databases -- all the fun that is involved in keeping a mess of webapps running. Well blogger and google talk work so all is not lost. God bless them.

Now its back, I guess 20 minute outage isn't that bad for Beta app :)

Easy CentoOS 4.6 Network Installation

With a few exceptions (having to use Cisco Enterprise Linux for a project or two, and few torrid affairs with SuSE) ever since about 2001, I've been mostly faithly to Debian-based distributions. One of the things that has bothered me about RPM distros is the network installs, or lack thereof. Sure you can do it (I did on an old-world PPC Mac using YellowDog Linux) but it is not as straightforward as Debian network installs.

For me the only reason you'd use and infererior RedHat-based distros is if you had commercial products that required RHEL. Well now im in that situation, so CentOS 4.6 it is, and its not as hard as I thought.

1. Find the boot.iso on one of the mirrors (it should be located in centos/4/os/i386/images/) I used http://isoredirect.centos.org/centos/4/os/i386/images/boot.iso
2. Choose text linux at the boot loader
3. Select HTTP install
4. For the IP address enter the name of your mirror (I used isoredirect.centos.org) and the path (/centos/4/os/i386/) and it should find everything you need

That's it...

Moin 1.6.1 Goodness

Just saw on the Python Cheese Shop that MoinMoin 1.6.1 is out. A little dated (looks like it came out 2/4/08) but better late than never, so I gave it a spin.

The most obvious advantage of this latest version (or at least starting with 1.6.0) is that the portable (i.e. non-Apache requiring) DesktopEdition is now standard so that the wiki is as easy to start as "python moin.py"

I've actually used this portable version a lot over the past few years. As a consultant, when I did SCADA (or webapp) vulnerability assessments, I would create a new wiki instance for each asssement. I had a template based on our methodology so I could easily record test results or capture information from the client. I could add screen shots, file attachments, you name it. To solve the offline, distributed aspects of wikis, is as simple as rsync and it was easy enough to connect to other wiki instances saved on servers using SSH port forwarding.

Here is the full list of features, but for me this are the big ones:

• It is not not in PHP!
• It doesn't require a relational database
• It has a mature rich syntax
  
• It is portable
• Templates, templates, templates!
  

Basically the converse of these are why I hate Media Wiki (what is used by Wikipedia).

Once you get addicted to wikis it is hard to stop, so you start taking notes in wiki format with your text editor even if you don't use a wiki.

Full Circle?

Life is full of surprises.

Twenty-five years ago (in the last gasp of the Cold War) if you'd told me that in first months of the new Millennium, I would make footprints in the fresh February snow in one of Stalin's secret cities and enter the courthouse to adopt a Russian toddler (the thick iron door ominously slamming shut, as we entered) I would have have laughed at you. Likewise, if you told me I would someday lift off on a China Southern 737, bound for Guangzhou, from the city where Chairman Mao studied philosophy, with a scared 13-Month old Chinese daughter, looking forward to the comforts of the White Swan Hotel.

Twenty years ago (as I was close to graduating from high school, in a town I did not like, where I'd only lived for less than a year, where I couldn't wait to leave) if you had told me that I'd be back there in twenty years with three kids and I wife of almost 15 years, I would have said no way in hell would I ever move back. Why, oh why would I do that?

Ten years ago (fresh after the Smurf attacks of 98, after just embarking on my network security career as a junior *NIX instructor for a government contractor in San Antonio) if you had told me that ten years later I'd be doing network security training again four employer's (and almost same multiple of my salary) later, I would not have known what to say.

Five years ago, if you had had told me that I would someday be able to rattle of the names and dosages of commonly prescribed neuroleptics, and would have the seen first hand the effects (both good and bad) of stimulants, anti-depressants, and mood stabilizers on a child of mine, I would have said you were the one that was crazy.

A year ago, if you had told me that I would be blogging with my 3 month old asleep on my chest, his mouth open (having inherited my allergic genes, the humidifier droning on) I would ask what miracle brought this about?

* * *

Life is uncertain. The future is full of surprises. For all the apparent familiarities of time and space, with each turn around the labyrinth, it is not the same. You were not here before.

Life is a free fall. Immediate control is an illusion. At best, you alter the angle (if not the rate) of descent--or maybe your perspective on the horizon.

Simple choices have unforeseen consequences. Big decisions are unreal and awesome, impossible to comprehend.

* * *

In the coming months, we prepare to move East, to the land of the Chesapeake and the Catoctins -- a move which somehow feels unnatural, like turning back the clock, like flowing against against History.

East? It was always the West where you thought you would end up.

After all, who returns home without good reason?

Vote for Irony

As opposed to creepy stuff like choir thing or other parodies.

Air America Caves on Wright Controversy

I don't think it was just because of all the stand-in (Ed Schultz, Stephanie Miller are all off the air) but, yesterday, I was amazed at the condemnation of Pastor Wright's remarks by all these Lefties.

Some of this may only be pragmatic (Air America radio hosts are generally pro-Obama and they don't want their guy to lose) but Randi Rhodes talking about the need for "separation of church and state." Don't mix politics and religion? What planet are they on? Obviously, these folks have never stepped in the doors of mainline/Liberal Christian denomination with any focus on social justice, where politics does show up in sermons. While the Episcopal Church is my primary (and most recent) data point, I believe this also applies to Liberal (i.e Reform/Reconstructionist) Judiasm as well based on our experience of briefly attending a couple of Reform Temples in Austin and San Antonio.

I really don't see why everybody is hyperventilating. Critique of American hubris or blind support of Israel/sympathy with the Palestinian cause, examination of consequences for short-sighted American foreign policy, etc. is fairly common fare in Liberal churches. Engagement with politics and culture is not (and should not) be taboo in the Church. Spritual growth is not (and should not be) about telling you what you want to hear. It should challenge and interrogate your faith. Otherwise what is the point?

With Supporters Like This...

Say isn't that guy on the left (the one with the white Tee and stocking cap) in 30 Rock?



I'll just say its a stroke of genius to be able to come up with videos like this that somehow seem to be parodies of themselves.

Pen Test Sins (Mea Culpa, Mea Culpa)

DaveG goes to confession. I'm not Catholic but close enough.

What I've been guilty of:

1) Time Management - most of effort is in the first and last 20% of the project, the terrible middle 60%

4) Over-Automation - spending half the project writing new tools (more fun writing fuzzers than running them!)

5) Sloth - let the junior guy do the boring work

6) Stagnation - Cisco, anyone?

Are you a contractor?

From a Wire episode I haven't seen yet. My wife sure knows how to find the best YouTube videos.

Debian Moin Updates Out, Still Waiting on Ubuntu LTS

Looks like the Etch updates have made it out. I've been too busy/lazy to update my VPS box since the Moin vulns were disclosed and was thinking about migrating away from the built in package on my VPS box but I'll wait another week to see if these show up in Ubuntu LTS.

Best Omar Caper So Far

So we finally started on Season 3 (switched back to Netflix from Blockbuster Online, yes there is a reason Blockbuster is in trouble) of The Wire and its always a pleasure to watch how Omar and crew trick various drug dealers. In this episode one of his ladies (dressed like a nurse) wheels (as in chair) Omar into one of Avon's stash houses pretending to be a "brother Earl" from a VA hospital..

- Yo, all due respect, but this right here is a Barksdale joint, man.
- Do tell,

It is pretty simple

I'm not so sure of the generational consequences if the Clintons manage to scuttle Obama in the coming weeks and months

If this promise is eclipsed because the old political system conspires to strangle it at birth, the reaction from the new influx of voters will be severe. The Clintons will all but guarantee they will lose a hefty amount of it in the fall, as they richly deserve to. Some will gravitate to McCain; others will be so disillusioned they will withdraw from politics for another generation. If the Clintons grind up and kill the most promising young leader since Kennedy, and if they do it not on the strength of their arguments, but by the kind of politics we have seen them deploy, the backlash will be deep and severe and long. As it should be.

but I do know that voting for McCain (no matter how much he contorts himself it all that he was not in the 2000 campaign and while an underdog) or, more likely, another year skipping out on the election (like 1992, 1996, 2000) is no sweat for me. And the same goes for the dream team (the arrogance of the Clintons, on this is too much to take) for if Obama were to VP (pick Hillary as VP) all his hope & change will have indeed turned out to be hot air.

However, the amusing thing is the number of folks on the Left (my data being the shows on Air America I listen to during my commute or when shuttling between data centers during the day) that are absolutely pissed about the Clintons.

Must be a lot of Obama calls to Texas

So I entertained the idea of calling Texas for Obama but the link is unresponsive. Must be a lot going on down there. Yet another reason it would be good to be back in Texas.

Talent, Retention, and the 18 Month Window

As I was catching up on my business feeds like Tom Peters when I ran across A Focus on Talent

I found it interesting that the majority of senior leaders (92%) rank hiring the right talent as important. I totally agree that hiring the right people is critical to the essence of business, but I also believe that there is a gap when it comes to retaining the people that are hired. Equal attention must be given to existing staff.

Can you recall how excited you were your first day on the job and how exhilarating you thought things would be? Do you still feel that way now? Are you doing work that truly engages you, are you sufficiently challenged to tap into all your talents, and do you feel that your opinions and ideas are valued?

The culture that organizations create has everything to do with how people feel in the organization. Time, money, and effort can be spent hiring the right person, but if the same amount of energy is not put into creating and sustain the right culture, it is like playing a slot machine—you waste a lot of money trying to get a few wins.

I was chatting with a friend of mine who I worked with at Cisco earlier in the week, who left about the same time I did. He has been through another largish hardware vendor, a startup, and is now back in a different BU. We were joking about the "18th Month" magic window after which that "new job smell" is thoroughly extinguished. And I though it was just me.

While "tragedy" is probably too strong a word, it must certainly be frustrating for 1st level managers to be on the front lines seeing the impact of choices made by their bosses or other factors outside of their control.

The Sweet Heresy of GNU/kFreeBSD

mfranz@gutsy61:~$ ssh root@192.168.1.105
root@192.168.1.105's password:
Last login: Sat Mar 1 13:30:50 2008 from 192.168.1.107
GNU/kFreeBSD debian 6.3-1-486 #0 Fri Feb 15 22:53:48 CET 2008 i686

The programs included with the Debian GNU/kFreeBSD system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/kFreeBSD comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
debian:~# uname -a
GNU/kFreeBSD debian 6.3-1-486 #0 Fri Feb 15 22:53:48 CET 2008 i686 i386 Intel(R) Pentium(R) Dual CPU E2140 @ 1.60GHz GNU/kFreeBSD

425kpps it is for the DL385G2 (on FreeBSD 6.2)

So for a while this afternoon, I was worried that I wasn't going to be able to generate enough traffic using Click Router on a Compaq DL-145G3 to flatten (meaning, cause packets to drop/stop being forwarded, cause the CPU Interrupt Utilization was around 30%) its big brother/sister.

But if you were always wondered what it took to bring on an interrupt storm on a Compaq DL-385G2 (Opteron with 4 Cores + Quad Intel PCIe NIC) it is around 425 kpps UDP (using 60 byte packets)

Tomorrow I find out what it takes on the Intel counterpart (DL380G5)

Java6 on Nexenta

Anyone have any luck?

The x86 .sh installer script failed for me -- said it was corrupt

And pkgadding the .Z started out promising enough

root@myhost:~# pkgadd -d . SUNWj6cfg                  
sunwj6cfg_04-1_solaris-i386.deb generated
sunwj6dev_04-1_solaris-i386.deb generated
sunwj6dmo_04-1_solaris-i386.deb generated
sunwj6jmp_04-1_solaris-i386.deb generated
sunwj6man_04-1_solaris-i386.deb generated
[snip]
 dependency problems - leaving unconfigured
Setting up sunwjavadb-common (1.0-1) ...
Setting up sunwjavadb-core (1.0-1) ...
Setting up sunwjavadb-demo (1.0-1) ...
Setting up sunwjavadb-docs (1.0-1) ...
Setting up sunwjavadb-javadoc (1.0-1) ...
dpkg: dependency problems prevent configuration of sunwj6jmp:
 sunwj6jmp depends on sunwj6man; however:
  Package sunwj6man is not configured yet.
dpkg: error processing sunwj6jmp (--install):
 dependency problems - leaving unconfigured
Setting up sunwjavadb-client (1.0-1) ...
Errors were encountered while processing:

but ended in .deb dependency hell

and then

root@myhost:~# apt-get install -f   
Reading package lists... Done
Building dependency tree       
Reading state information... Done
Correcting dependencies... Done
The following packages were automatically installed and are no longer required:
  sunwj6jmp sunwj6man sunwj6rt sunwj6cfg sunwj6dev sunwj6dmo
Use 'apt-get autoremove' to remove them.
The following packages will be REMOVED:
  sunwj6cfg sunwj6dev sunwj6dmo sunwj6jmp sunwj6man sunwj6rt
0 upgraded, 0 newly installed, 6 to remove and 0 not upgraded.
6 not fully installed or removed.
Need to get 0B of archives.
After unpacking 82.4MB disk space will be freed.
Do you want to continue [Y/n]? Y
(Reading database ... 37360 files and directories currently installed.)
Removing sunwj6cfg ...
Removing sunwj6dev ...
Removing sunwj6dmo ...
Removing sunwj6jmp ...
Removing sunwj6man ...
Removing sunwj6rt ...

Intro to Solaris Zones: Part I

The Intro to Solaris Zones chapter isn't actually that bad and helped filled in some gaps in my knowledge regarding these virtualization features I've been hearing about (but never actually used) and there are detailed instructions so detailed in fact after working pretty much everday since last Sunday and getting back from the data center again early in the moring, it is putting me to sleep. Yeah, whine! whine! Not much good it will do you.

Nexenta: It's Solaris Except Sort Of Usable

I was amazed a functional Solaris box in less than 30 minutes. Must be a world record. And perusing through dpkg -l I found lots of cool stuff: WPA/wireless tools, xen, Solaris Zone utilities, Python, Perl, ipfilter (of course, but not ipfmeta), gcc, sqlite, iSCSI/FCIP junk, wireless driver for 4965AGN (what the...) Package repositories seem sort of light. What kind of lame distro dosen't have precompiled versions of nmap or ngrep? Also tried to apt-get install openbox but no love. Definitely lose points for that. But all in all I'm impressed and it will give me a chance to play around with some cool Solaris-only stuff (like ZFS and these zones/container things I've been hearing about) without the headache of a real install.

Here's some juicy bits

root@myhost:/# df -k
Filesystem            kbytes    used   avail capacity  Mounted on
syspool/rootfs-nmu-000
                     7676928  880835 6781991    12%    /
/devices                   0       0       0     0%    /devices
/dev                       0       0       0     0%    /dev
ctfs                       0       0       0     0%    /system/contract
proc                       0       0       0     0%    /proc
mnttab                     0       0       0     0%    /etc/mnttab
swap                  631648     704  630944     1%    /etc/svc/volatile
objfs                      0       0       0     0%    /system/object
sharefs                    0       0       0     0%    /etc/dfs/sharetab
/usr/lib/libc/libc_hwcap1.so.1
                     7662826  880835 6781991    12%    /lib/libc.so.1
fd                         0       0       0     0%    /dev/fd
swap                  630952       8  630944     1%    /tmp
swap                  630976      32  630944     1%    /var/run
/dev/dsk/c1t0d0s2     421636  421636       0   100%    /media/Elatte_InstallCD


root@myhost:/var/adm# mount
/ on syspool/rootfs-nmu-000 read/write/setuid/devices/nonbmand/exec/xattr/atime/dev=2d90002 on Sun Feb 24 19:47:58 2008
/devices on /devices read/write/setuid/devices/dev=4bc0000 on Sun Feb 24 19:47:35 2008
/dev on /dev read/write/setuid/devices/dev=4c00000 on Sun Feb 24 19:47:35 2008
/system/contract on ctfs read/write/setuid/devices/dev=4c80001 on Sun Feb 24 19:47:35 2008
/proc on proc read/write/setuid/devices/dev=4cc0000 on Sun Feb 24 19:47:35 2008
/etc/mnttab on mnttab read/write/setuid/devices/dev=4d00001 on Sun Feb 24 19:47:35 2008
/etc/svc/volatile on swap read/write/setuid/devices/xattr/dev=4d40001 on Sun Feb 24 19:47:35 2008
/system/object on objfs read/write/setuid/devices/dev=4d80001 on Sun Feb 24 19:47:35 2008
/etc/dfs/sharetab on sharefs read/write/setuid/devices/dev=4dc0001 on Sun Feb 24 19:47:35 2008
/lib/libc.so.1 on /usr/lib/libc/libc_hwcap1.so.1 read/write/setuid/devices/dev=2d90002 on Sun Feb 24 19:47:56 2008
/dev/fd on fd read/write/setuid/devices/dev=4f00001 on Sun Feb 24 19:47:58 2008
/tmp on swap read/write/setuid/devices/xattr/dev=4d40002 on Sun Feb 24 19:48:04 2008
/var/run on swap read/write/setuid/devices/xattr/dev=4d40003 on Sun Feb 24 19:48:04 2008
/media/Elatte_InstallCD on /dev/dsk/c1t0d0s2 read only/nosetuid/nodevices/noglobal/maplcase/rr/traildot/dev=3580002 on Sun Feb 24 19:48:25 2008

Starting Nmap 4.20 ( http://insecure.org ) at 2008-02-24 19:50 CST
Interesting ports on 192.168.1.113:
Not shown: 1693 closed ports
PORT     STATE SERVICE
21/tcp   open  ftp
22/tcp   open  ssh
111/tcp  open  rpcbind
4045/tcp open  lockd
MAC Address: 00:1D:09:28:B9:85 (Unknown)
Device type: general purpose
Running: Sun Solaris 9|10
OS details: Sun Solaris 9 or 10
Uptime: 0.005 days (since Sun Feb 24 19:43:04 2008)
Network Distance: 1 hop

root@myhost:/usr/local/bin# irb
irb(main):001:0> puts RUBY_PLATFORM
i386-pc-solaris2.11
=> nil
irb(main):002:0> 

Nexenta Core 1.0 Release

Just to prove that I'm not a Linux bigot, I'll admit that I've played around with some of the OpenSolaris distributions over the past few years but a couple of things have always pissed me: 1) the same god-awful (blue and red colored) x86 installer I first used back in 90s 2) they were huge, bloated, and desktop focused.

I'm only about 10 minutes into the install
Nexenta Core seems to addressed seems to have addressed both of these concerns:


List of the changes and highlights
======================

# OpenSolaris b82 based (x86, 32bit and 64bit, non-debug)
# Ubuntu/Dapper based
# Project integration: NWS, AVS, COMSTAR, in-kernel CIFS client
# apt-clone: ZFS-integrated safe upgrade via remote APT repository
# Support for in-place (live) and safe upgrades
# Installer: multiple improvements; installs from USB
# Small memory requirement: 256MB
# Nexenta Zones: multiple improvements; integrated automatic Zone upgrades
# CIFS client included in the default installation
# Xen DomU and Xen Dom0 (32bit, [2])
# GRUB-integrated memory test
# Nexenta ISO Builder ([3])
# APT repository - status complete. Stable repository (elate-stable)
ready for usage.

About Nexenta Core Platform (NexentaCore)
=============================

Nexenta Operating System is a free and open source operating system
combining the OpenSolaris kernel with GNU application userland. Nexenta
Operating System runs on Intel/AMD 32/64bit hardware and is distributed
as a single installable CD. NexentaCore is a minimal (core) foundation
that can be used to quickly build servers, desktops, and custom
distributions tailored for specialized applications. The latest and
previous NexentaCore releases are available at [4]. With the power of
Debian tools behind it, NexentaCore could be customized for any vertical
application or distribution: KDE, GNOME, XFCE centric Desktops, LAMP
servers, Xen Dom0 ZFS-powered servers, and more. Unlike NexentaOS
desktop distribution, NexentaCore does not aim to provide a complete
desktop. The overriding objective for NexentaCore is....

Welcome Back Daily Dish

Here are the highlights, but definitely check out The Clinton's Last Stand:

Clinton is a terrible manager of people. Coming into a campaign she had been planning for, what, two decades, she was so not ready on Day One, or even Day 300. Her White House, if we can glean anything from the campaign, would be a secretive nest of well-fed yes-people, an uncontrollable egomaniac spouse able and willing to bigfoot anyone if he wants to, a phalanx of flunkies who cannot tell the boss when things are wrong, and a drizzle of dreary hacks like Mark Penn. Her only genuine skill is pivoting off the Limbaugh machine (which is now as played out as its enemies). Her new weapon is apparently bursting into tears. I mean: really.

and

How did they come this close to losing this? They had all the money, all the contacts, all the machine levers, the entire establishment, the biggest Democratic name in decades, and they've been forced into a humiliating death-match by a first-term black liberal with a funny name. It seems obvious to me that the Clintons blew this because they never for a second imagined they could. So they never planned to fight it. Once put in a fair contest, they turned out to be terrible campaigners, terrible politicians, bad managers, useless executives, wooden public speakers. If you're a Democrat, that's good to know, isn't it? All that bullshit about Day One and experience? In retrospect: laughable.

Of course some this argument hinges on the assumption that well-run campaigns (which seems to be the case for Obama?) have a higher probability of producing well-run executive branches and competent presidencies. I wasn't nearly as obsessed with '04 or '00 to know whether Dubya's/Rove's campaigns were as disciplined and competent but the White House tenure has obviously been far from that...